Data protection impact assessments fail for one of two reasons: they are so heavy that teams avoid triggering them, or so light that they document a decision already made.
This methodology solves the first problem with a genuine threshold test — twelve questions that take ten minutes and produce a defensible yes or no — and the second with a template that forces the necessity and proportionality analysis to happen before design is locked.
The AI impact assessment module extends the same logic to algorithmic systems, covering training data provenance, fairness evaluation across affected groups, human oversight design and post-deployment monitoring, mapped to ISO 42001 Annex A.
Why it is structured the way it is, and the failure patterns it was designed around.
A consent banner records a choice. A consent architecture enforces it. Here is the two-hour test that shows which one you have — and how to fix the gap.
The technical specification for consent that actually propagates — data model, event schema, versioning rules and downstream enforcement patterns.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 2.6, revised 11 June 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
DOCX + XLSX · 52 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Independence is not a job title. It is a reporting line, a documented advice trail, and protection from consequence. Here is what regulators look for and what fails.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
